Privacy Policy

This includes showing you the products you want to buy, and knowing where you live and how to contact you. It also includes taking your payment details and processing them so you can pay for what you buy and checking you can afford to purchase what you have asked for and that you are of an appropriate age to do so. We do this as our core business activity selling fashion, electricals and other products to people who want to order online or through mail order.

Making sure the offers and suggestions we send you are appropriate for you by using your personal data to make predictions about what you will like helps make our marketing more efficient, keeping costs lower for all of our customers. We also try to encourage new customers to shop with us by sending them direct marketing, mainly through the post. We process details of how you browse our websites and use this information to target advertising when your browse the internet or through emails. We do this to ensure that our company grows and to link people with products that they are interested in.

As a major e-commerce and home shopping retailer we have an interest in a healthy industry of companies operating in a similar fashion. Sharing data helps us to grow this industry in ways that benefit our company and our customers. In order to grow our customer base we need to find the contact details of customers from other companies and this includes data brokers. Data is also valuable and as a private company we have to make a profit to survive and to continue to offer services to customers. So sometimes we will sell personal data directly to organisations who also wish to obtain new customers. This involves a financial transaction that helps our company to make reasonable profits and also to keep our product prices affordable for people who shop with us.

We process data about you to make an initial offer of credit based on verifying your identity, eligibility and financial standing. We collect information from you directly to do this and we also enhance this data with information from other sources. We collect data directly from you relating to your income, household income and number of financial dependents. This enables us to assess the affordability for you of any credit facility we offer.

We may from time to time make promotional offers such as Buy Now Pay Later (BNPL). Eligibility is decided by reference to a number of factors including the way you have managed your account with us. We may also use information from third parties when considering your eligibility for an offer. For example, to reflect the risk to our business we may use information from credit reference agencies to decide whether to offer you BNPL and the criteria may be different from those used in making the initial offer of credit. You may ask us to review any decision not to make you a BNPL offer on the basis that decision is made by solely automated means by emailing dataprotection@lookagain.co.uk.

We also have to process data to let our regulators know how we are treating you and also how well your management of your account reflects on your approach to credit generally. We have to ensure that we do not get defrauded and that we can recover money we are owed so we have to process information about the devices you use to interact with us including digital fingerprinting to prevent fraud. We also have to process information about your circumstances to ensure we take a responsible approach if you get into financial difficulties or to help us to enforce our legal rights if you decline to pay. Specifically we process data about your payment history with us and we share it with credit reference agencies. We do not use your consent to do this as this would incorrectly suggest that there is a choice for you when in fact we are required to share such data with the agencies as part of our duties as a responsible provider of credit.

For our legitimate interests in running a business we also collect your contact details from people who sell and/or rent data for marketing purposes as well as performing mutual swaps of contact details with other companies who sell similar products to us. You can opt out of this sharing at any time by emailing dataprotection@lookagain.co.uk.co.uk. We also use your date of birth and information about your buying habits with us and other retailers to ensure that the offers and product information we send to you is suitable for both your interests and your circumstances. We also use data about your browsing on our websites to assist us in personalising your browsing experience and providing you with appropriate offers exactly when you need them. We also use information on your available credit with us to try and offer you only products you can afford.

We randomly monitor and record calls to our customer services and other departments. This helps to ensure that we provide you with the highest level of service and maintain quality standards.

We use encryption and pseudonymisation to help us keep your information secure and we take steps to protect the electronic and physical security of our data assets including keeping our servers in secured buildings and limiting access to our IT systems.

We provide training in cybersecurity to our staff and mandatory awareness training in Data Protection to all staff who may come into contact with personal data. Some groups of employees receive role specific training if they are likely to come into contact with personal data that we view as requiring a higher level of protection.

Where employees have access to personal data their access is restricted to only the personal data they need to do their job. Where we transfer data to processors or suppliers we use encryption, secure file transfer protocol (sftp) and password protection of files to ensure that data cannot be used by anyone other than the individual who it is intended for.

We will continue to receive data from Credit Reference Agencies on a monthly basis for the period that your credit account remains open. If you do not repay on time or in full, we will tell the Credit Reference Agencies who will record details of the debt. All this information will be seen by other organisations carrying out later searches. You have the right of access to your personal records held by Credit Reference and Fraud Prevention Agencies. We use data held by Experian, Equifax and CallCredit.

We, the Credit Reference Agencies and Fraud Prevention Agencies may also use the records for statistical analysis about credit, insurance and fraud.

You can get more information about how the Credit Reference Agencies use your information at the following websites:

Transunion: www.transunion.co.uk/crain

Equifax: www.equifax.co.uk/crain

Experian: www.experian.co.uk/crain

If you do not repay the money you owe, we will pass your information on to companies who recover debt.

These companies will also pass data about you to us and include or have included:

Lowell Financial Ltd - https://lowell.co.uk/

EOS UK - https://uk.eos-solutions.com/services/debt-collection/

Moorcroft Debt Recovery Ltd - https://www.moordebt.com/

We will also share your details with registered insolvency practitioners and other companies involved in managing insolvencies.

There are two principal ways in which we share data with other retailers in exchange for data about prospective customers. One is through data co-operatives where a number of retailers share information on their customers both to improve our understanding of our customers and to exchange details. The other means is by direct swaps of customer lists with other fashion, homeware and electrical retailers.

We are part of a wider group of companies, the Otto Group. We sometimes transfer personal data to our sister companies in the Otto Group on occasion. Details of who these companies are can be found here https://www.ottogroup.com/en/ueber-uns/konzernfirmen/hermes-europe.php

In the event of our business, or any part of it, being sold your data will be transferred to the purchaser of the business.

As part of our normal operating procedures as a large business we are sometimes required to send personal data about our credit customers to banks in order to securitise our operating funding. We do this with the Royal Bank of Scotland and it has no impact on you as an individual.

We may also share your information with the police, our regulators and other government agencies where required to do so by law or a regulatory request.

Before we provide services, goods or financing to you, we undertake checks for the purposes of preventing fraud and money laundering, and to verify your identity. The personal data you have provided, we have collected from you, or we have received from third parties will be used to prevent fraud and money laundering, and to verify your identity. Details of the personal information that will be processed include, for example: name, address, date of birth, contact details, financial information, employment details, device identifiers including IP address and vehicle details. We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime. We process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our business and to comply with laws that apply to us. Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years. As part of the processing of your personal data, decisions may be made by automated means. This means we may automatically decide that you pose a fraud or money laundering risk if our processing reveals your behaviour to be consistent with money laundering or known fraudulent conduct; or is inconsistent with your previous submissions; or you appear to have deliberately hidden your true identity. You have rights in relation to automated decision making that are detailed below in the section “How to complain or object” If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services or financing you have requested, or to employ you, or we may stop providing existing services to you. A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us using the details below. Whenever fraud prevention agencies transfer your personal data outside of the European Economic Area, they impose contractual obligations on the recipients of that data to protect your personal data to the standard required in the European Economic Area. They may also require the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing.

The Right to Access enables you to get confirmation of whether we have any information about you and to get a copy of that information as well as to understand why we have it, what we use it for and where we got it from.

The Right to Portability enables you to get some of your information in an easily machine readable format. This right is only applicable where the data is used for the performance of a contract or relies on your consent and is data that you provided to us. For our company that means we will give you a machine readable copy of your transaction data (ie the items you ordered and payments you made) and any device fingerprinting data we have that we collected based on your consent.

The Right to Rectification says that we will correct any inaccurate data we hold on you. We would always want to correct inaccurate data. Where we disagree that the data is inaccurate you can ask to have an explanation attached to the data making clear that you disagree with us and why.

The Right to be Erasure (Right to be forgotten) means that we must delete data on you if the reason we collected it is no longer valid, if we asked for your consent and you chose to withdraw it, if we do not have a sufficiently strong legitimate interest to use it and you object, if we have used it unlawfully or if we are required to forget you by law. This does not mean that we will erase information about your credit account or the way you have managed it. This information is processed as part of our contract with you and as a responsible lender we are required to keep this data for seven years. We also keep a record of your request for erasure, and if you ask us not to contact you for marketing purposes we keep a copy of your details to make sure we do not send you marketing in future. This is known as a suppression list.

The Right to Restriction means that we won’t process your data at all (apart from storing it) while we verify its accuracy, establish whether our processing is lawful or where we don’t need the data but you want us to keep it for establishing legal claims. If you ask us to assess whether our processing is within our legitimate interests, necessary and does not override your legitimate interests we have to restrict processing of your data. We will tell you before we start to use it again

The Right to Object applies whenever we process data in our legitimate interests. You have the right to ask us to consider any objection you have to the way we process your data and if we cannot show a compelling reason to continue we have to stop. This right also gives you the ability to tell us not to send you any direct marketing from any of our brands at any time by dataprotection@lookagain.co.uk. This is an absolute right that we are committed to respecting.

We start to delete much of the data on previous employees with no disciplinary records after two years. We will retain enough information to show that someone worked for us, or the reasons for their dismissal.

There will be situations where we need to keep very specific data for longer. For example, we will retain all currently held data on PPI sales until at least August 2019. If other financial products are subject to significant remediation or are viewed as significant risks to customers, we will retain data for longer than described in this privacy policy.

For marketing to you by email or SMS, we rely on our legitimate interests using the soft opt in provisions of the Privacy and Electronic Communications Regulations.

For marketing to you through push notifications to our apps on mobile devices we rely on your consent, which you can withdraw at any time on your device.

This privacy policy describes our lawful bases for our major activities. Within those activities there may be specific processes where we rely on a different lawful basis.

We accept the guidance issued by the Information Commissioner’s Office on the subject of consent. This means that where we use an opt out mechanism this is a means of allowing you to object to processing that we perform because we believe it is in our legitimate interests. The opt out mechanism is a means of giving you control but we fully accept it does not indicate consent. We will always respect any opt out that you choose to exercise and will never seek to over-ride it using our legitimate interests.

Some of our suppliers despatch goods directly to you. They will receive your delivery details and some contact details including your phone number and email address to enable them to do this. Where these companies are outside the European Economic Area we have a binding contract with them to protect your personal data.

Companies that use EU Commission standard contract clauses

Conversant – This is a company that uses data on what you have bought from us in the past to ensure that the adverts from us you see on the internet are of a product you may wish to buy instead of the last product you viewed on our websites. Details of how to opt out of this are in our cookie policy.

We also use automated decision making and profiling when deciding what offers you receive with our marketing. We do not believe that this has a significant and serious enough impact on you to require us to reconsider the results of this profiling. If you object to any profiling of you for direct marketing purposes please email dataprotection@lookagain.co.uk.

You can access any of your rights under the EU General Data Protection Regulation or the Data Protection Act through the same routes. These are described in detail in the section of this policy on your rights. We will normally attempt to resolve any underlying problem at the same time as we process your request to use your privacy rights.

You should always make sure that your internet browser is up to date and that you have anti-malware software installed.

There are known security risks for users of Windows XP operating system when browsing with Internet Explorer. (Usually versions 7 & 8)

This has been proved to be insecure and leaves the customer’s details vulnerable to interception from a third party.

Because of this, we can no longer provide access to our website for these browser versions as this would put your personal data at risk.

If you wish to continue to access our website you will need to use a different device (if you have one available) or a different internet browser such as Chrome.

Microsoft have provided advice on supported versions of their browsers here:

We maintain strict physical security controls including secure server rooms and staffed entrances to our buildings.

Staff are assessed for their reliability and suitability to handle personal data before they are employed in a role that allows them to access confidential customer information.

We have contracts in place with our suppliers that require them to keep data secure to at least the same standard as we do ourselves.

We are PCI-DSS level 2 compliant.